CVE-2026-18709
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.
Risk Assessment
Cross-shard data inconsistency and violation of transaction atomicity could lead to data corruption and database integrity issues, potentially affecting system reliability.
Recommendation
It is recommended to immediately upgrade MongoDB Server to a version that includes a fix for this vulnerability. Also, restrict direct network access to shards and monitor transactions.
Original NVD description (English source)
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could result in cross-shard data inconsistency, cluster clock corruption, and violation of transaction atomicity guarantees.